Executive brief
A security flaw was found in Keycloak's administrative interface, an open-source identity and access management solution. Under certain configurations, an administrator who is only supposed to search for users can bypass restrictions to view full user profiles, including sensitive personal information and security metadata. This could lead to unauthorized data exposure if a low-privileged administrator accesses details they are not permitted to see.
Technical details
An authorization bypass vulnerability exists in the Keycloak Admin UI extension's 'brute-force-user' endpoint. When Fine-Grained Admin Permissions (FGAPv2) are enabled, the system fails to perform a 'view' permission check in the BruteForceUsersResource.java component when a search is performed using a specific user ID. An authenticated attacker with the 'query-users' client role can exploit this by accessing the GET /admin/realms/{realm}/ui-ext/brute-force-user?search=id:{userId} endpoint. This allows the attacker to retrieve full user representations, including PII and brute-force metadata, for users they are not authorized to view.
Affected products
- Red Hat Red Hat Build of Keycloak
- Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
- Keycloak Keycloak Admin UI extension
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory